CVE-2026-66013 INCIBE-CERT - Vulnerabilities RSS / 1d OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without authentication or ownership validation, redirecting notifications or denying delivery to legitimate consoles.
Puntuación base: 9.30 CRÍTICA Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Vector de acceso (AV): A través de red Complejidad de acceso (AC): Bajo Attack Requirements (AT): Ninguno Privilegios Requeridos (PR): Ninguno Interacción del usuario (UI): Ninguno Confidentiality (VC): Alto Integrity (VI): Alto Availability (VA): Bajo Confidentiality (SC): Ninguno Integrity (SI): Ninguno Availability (SA): Ninguno
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
